add 0031/SESSION-0031.0-TRANSCRIPT-2026-05-28T17-14--2026-05-28T18-47.md + replace placeholder/variant SESSION-0031.0-TRANSCRIPT-2026-05-28T17-14--2026-05-28T17-21.md

0031/SESSION-0031.0-TRANSCRIPT-2026-05-28T17-14--2026-05-28T18-47.md

@@ -2,7 +2,8 @@
 
 > Date: 2026-05-28
 > Start: 2026-05-28T17-14 (PST)
-> End: 2026-05-28T17-21 (PST)
+> End: 2026-05-28T18-47 (PST) — re-finalized after a second work item
+>   (flotilla v1.2.0 merge) landed post-publish.
 > Driver: OHM roadmap driver session, parallel-safe.
 > Claimed ID 0031 via `claim-session-id.sh` (active at claim time:
 > 0026, 0027, 0030 still `--INPROGRESS`).
@@ -28,6 +29,19 @@ annotated ROADMAP #34 (`ohm-rfc` `main` @ `392dab2`). **Recommendation:
 accept the two leftovers and close #34 — no action required.** No
 deploy this session (#34 needs none).
 
+**Addendum (post-publish, operator-directed):** after #34 wrapped and
+the transcript first published, the operator asked about open PRs and
+then authorized merging the built-but-unmerged **flotilla v1.2.0**
+(Session 0028). Landed it via **PR #2** (gitea API, FF-merge) over the
+§0026 security-hardened `main`, resolving the one `deploy.py` conflict
+so the §0026 redaction invariant holds on v1.2.0's new `SshError`
+lock-release path; **184 tests green**; tagged **v1.2.0** @ `ef34ffe`.
+Mid-way we hit a **shared-checkout collision** — the other live session
+reset the flotilla working dir out from under an in-progress merge — so
+the operator paused us, settled 0030 (which shipped rfc-app v0.27.0),
+and the redo was done in an **isolated worktree**. No OHM deploy: v1.2.0
+is operator-tool code.
+
 ---
 
 ## Launch prompt (verbatim summary)
@@ -176,6 +190,54 @@ one-command operator check.
 
 ---
 
+## Addendum — flotilla v1.2.0 merge (post-#34, operator-directed)
+
+Sequence after the first publish:
+
+1. **Operator asked "any PRs open to merge?"** API sweep: no open PRs
+   anywhere. flotilla security-hardening **PR #1** (from
+   `session-0030/flotilla-security-hardening`) already merged →
+   `main` @ `7b32a46`. rfc-app ships via direct tags (no PRs). Surfaced
+   the real loose end: **`session-0028/flotilla-v1.2.0`** built but
+   never PR'd/tagged (latest tag was `v1.1.0`).
+2. **Operator: "open and you have permission to merge."**
+3. **Collision.** First merge attempt was on the *shared* flotilla
+   checkout; the reflog showed a `reset` + checkout-to-`main` that
+   wiped my uncommitted merge — the **other live session operating in
+   the same working dir**. Caught it via a `VERSION=1.1.0`-where-1.2.0-
+   expected smell test (the reset had reverted the metadata files).
+   Operator paused us, got 0030 to a clean state (0030 shipped rfc-app
+   **v0.27.0**), then said proceed.
+4. **Redo in an isolated worktree** (`/tmp/flotilla-merge-0031`, new
+   branch off `origin/main`, dedicated venv so the editable install in
+   the main checkout couldn't shadow the merged source).
+5. **One conflict — `ohm_rfc_app_flotilla/deploy.py`.** §0026 hardening
+   (HEAD) had switched the `_PhaseFailure` path to the redacted
+   `safe_detail`; v1.2.0 added a new `except ssh.SshError` branch
+   (records a clean phase failure so the §8.3 deploy lock releases
+   instead of the row sticking `in_progress` — the v0.6.0 / Session
+   0009 fault). Resolution keeps the redaction **and** the SshError
+   branch, applying `self._redact(...)` to the new path too (judgment
+   call: the security invariant wins; `_redact` is a no-op when there's
+   nothing to redact, so v1.2.0's behavior/tests are preserved —
+   flagged to the operator as a one-line revert if they'd rather keep
+   exact bytes).
+6. **184 tests passed** on the merged tree.
+7. **PR #2** opened via gitea API (stored HTTPS credential, never
+   displayed; token scope `write:repository`), mergeable, **FF-merged**
+   → `origin/main` @ `ef34ffe`. Tagged annotated **v1.2.0** @ `ef34ffe`,
+   pushed (no mirror, SPEC §3.1). Worktree + merged PR branch cleaned
+   up. **Left the shared checkout at `7b32a46` untouched** (other
+   session may be in it; it FF's on next pull) and left
+   `session-0028/flotilla-v1.2.0` + its `…-s0028` worktree for 0028/
+   operator to clean up.
+
+**Lesson (§19.3-shaped):** parallel sessions MUST NOT do git mutations
+in a shared working dir. The worktree IS the isolation; the operating-
+instructions already say `isolation: worktree` for subagents — the same
+applies to a driver doing a hands-on merge. The `VERSION` smell test is
+what caught the silent stomp before anything was pushed.
+
 ## Next-session handoff prompt
 
 > OHM roadmap driver session, parallel-safe. Claim your ID first
@@ -191,10 +253,11 @@ one-command operator check.
 > `ohm-infra/GCP-NAME-ALIGNMENT-RUNBOOK.md` is **accept + close #34, no
 > action**. ROADMAP #34 annotated (`main` @ `392dab2`).
 >
-> Still in-flight / built-but-unmerged (confirm current state — some
+> Recently landed: flotilla **v1.2.0** MERGED + tagged (`ef34ffe`, PR
-> may have landed since): flotilla **v1.2.0** (PR), rfc-app
+> #2, Session 0031.0) — operator-tool code, no OHM deploy; rfc-app
-> **v0.25.0→v0.27.0** security-hardening (Sessions 0026/0027 — the
+> **v0.27.0** security-hardening SHIPPED (Session 0030). Note: the
-> working-tree WIP cleared mid-0031, so check whether it merged), #27
+> SHARED flotilla checkout (`…/ohm-rfc-app-flotilla`) was left at
+> `7b32a46` — `git pull` it to reach `ef34ffe`. Still pending: #27
 > **v0.24.0** Haiku tags (built, deploy gated on operator
 > `ANTHROPIC_API_KEY` + counsel pass — note the §18 chat stack may
 > already bind that key; check `flotilla secret list`).